如何通过web.config添加Sitefinity的identityServerSettings/scopes/groups元素？

问题 #

我正在为Sitefinity站点配置Azure单点登录（SSO），手动配置可正常运行，但每次代码更新时，构建管道会覆盖web.config里的配置。

我尝试在web.config中添加以下配置：

<!-- Sitefinity SSO -->
<add key="sf-env:authenticationConfig/securityTokenServiceSettings/authenticationProviders/OpenIDConnect:enabled" value="true" />
<add key="sf-env:authenticationConfig/securityTokenServiceSettings/authenticationProviders/OpenIDConnect:clientId" value="<redacted>" />
<add key="sf-env:authenticationConfig/securityTokenServiceSettings/authenticationProviders/OpenIDConnect:scope" value="openid profile email" />
<add key="sf-env:authenticationConfig/securityTokenServiceSettings/authenticationProviders/OpenIDConnect:authority" value="https://login.microsoftonline.com/<redacted>/v2.0/" />
<add key="sf-env:authenticationConfig/securityTokenServiceSettings/authenticationProviders/OpenIDConnect:redirectUri" value="https://<redacted>/Sitefinity/Authenticate/OpenID/signin-custom" />
<add key="sf-env:authenticationConfig/securityTokenServiceSettings/authenticationProviders/OpenIDConnect:postLogoutRedirectUri" value="<redacted>" />
<add key="sf-env:authenticationConfig/securityTokenServiceSettings/authenticationProviders/OpenIDConnect:title" value="Single Sign-On" />
<add key="sf-env:authenticationConfig/securityTokenServiceSettings/authenticationProviders/OpenIDConnect:requireEmail" value="false" />
<!-- Sitefinity SSO groups -->
<add key="sf-env:authenticationConfig/securityTokenServiceSettings/identityServerSettings/scopes/groups:name" value="groups" />
<add key="sf-env:authenticationConfig/securityTokenServiceSettings/identityServerSettings/scopes/groups:displayName" value="Azure AD Groups" />
<add key="sf-env:authenticationConfig/securityTokenServiceSettings/identityServerSettings/scopes/groups:claims" value="roles" />
<add key="sf-env:authenticationConfig/securityTokenServiceSettings/identityServerSettings/scopes/groups:scopeType" value="Identity" />
<add key="sf-env:authenticationConfig/relyingPartySettings:additionalScopes" value="groups" />
<add key="sf-env:authenticationConfig/securityTokenServiceSettings/identityServerSettings/identityServerClients/sitefinity:allowedScopes" value="openid profile rememberMe groups" />
<add key="sf-env:authenticationConfig/relyingPartySettings/claimsToRolesMappings/DEV Administrators:name" value="DEV Administrators" />
<add key="sf-env:authenticationConfig/relyingPartySettings/claimsToRolesMappings/DEV Administrators:claimType" value="roles" />
<add key="sf-env:authenticationConfig/relyingPartySettings/claimsToRolesMappings/DEV Administrators:claimValue" value="<redacted>" />
<add key="sf-env:authenticationConfig/relyingPartySettings/claimsToRolesMappings/DEV Administrators:mappedRoles" value="BackendUsers, Administrators" />

但Sitefinity启动时，针对<add key="sf-env:authenticationConfig/securityTokenServiceSettings/identityServerSettings/scopes/groups:name" value="groups" />抛出错误，提示“.../identityServerSettings/scopes/groups”元素不存在。我需要添加这个新的scopes元素，该怎么做？

解决方案 #

Sitefinity的sf-env配置语法中，新增集合类型的元素（比如scopes下的groups）不能直接通过冒号设置属性，必须先显式声明该元素存在于集合中，再设置其属性。具体步骤如下：

1. 先声明groups元素加入scopes集合
   在设置groups的属性之前，添加一行配置创建这个新的scope项：

   <add key="sf-env:authenticationConfig/securityTokenServiceSettings/identityServerSettings/scopes:add" value="groups" />
   

   这行配置会告诉Sitefinity在scopes集合中生成名为groups的新元素。

2. 保留原有的groups属性配置
   之前设置的groups相关属性可直接保留，但要确保放在上述声明之后：

   <add key="sf-env:authenticationConfig/securityTokenServiceSettings/identityServerSettings/scopes/groups:name" value="groups" />
   <add key="sf-env:authenticationConfig/securityTokenServiceSettings/identityServerSettings/scopes/groups:displayName" value="Azure AD Groups" />
   <add key="sf-env:authenticationConfig/securityTokenServiceSettings/identityServerSettings/scopes/groups:claims" value="roles" />
   <add key="sf-env:authenticationConfig/securityTokenServiceSettings/identityServerSettings/scopes/groups:scopeType" value="Identity" />
   

3. 调整后的完整groups配置段
   最终这部分配置应如下：

   <!-- Sitefinity SSO groups -->
   <add key="sf-env:authenticationConfig/securityTokenServiceSettings/identityServerSettings/scopes:add" value="groups" />
   <add key="sf-env:authenticationConfig/securityTokenServiceSettings/identityServerSettings/scopes/groups:name" value="groups" />
   <add key="sf-env:authenticationConfig/securityTokenServiceSettings/identityServerSettings/scopes/groups:displayName" value="Azure AD Groups" />
   <add key="sf-env:authenticationConfig/securityTokenServiceSettings/identityServerSettings/scopes/groups:claims" value="roles" />
   <add key="sf-env:authenticationConfig/securityTokenServiceSettings/identityServerSettings/scopes/groups:scopeType" value="Identity" />
   <add key="sf-env:authenticationConfig/relyingPartySettings:additionalScopes" value="groups" />
   <add key="sf-env:authenticationConfig/securityTokenServiceSettings/identityServerSettings/identityServerClients/sitefinity:allowedScopes" value="openid profile rememberMe groups" />
   <!-- 后续的角色映射配置保持不变 -->
   

4. 解决构建管道覆盖问题
   为避免web.config被频繁覆盖，建议：

   • 将这些SF-env配置移到单独的环境配置文件（如web.staging.config或web.prod.config），通过Sitefinity的环境配置机制加载，而非直接修改主web.config。
   • 或者在构建管道中添加自动注入步骤，确保部署后配置不会丢失。

内容的提问来源于stack exchange，提问作者Adeptus